privileges.5 (2010 09)

privileges(5) privileges(5)

WARNINGS

Product documentation, as discussed above, describes alternate ways that programs or users can obtain

sufﬁcient privileges to perform restricted operations.

Network Issues

Privileges are not propagated across distributed systems. They are applied only on the local system. For

example, a process with

PRIV_DACREAD or PRIV_DACWRITE

cannot access a ﬁle on another system if

it is necessary to override discretionary restrictions to do so.

For example, if the system’s NFS subsystem is conﬁgured to translate the user ID zero to the user ID

UID_NOBODY, it still does so. Also, some system daemons check to see if a connection originates from a

privileged port (typically 0-1023) to determine whether to allow or deny the connection. This behavior is

not and should not be altered.

Privilege Escalation

In certain situations, a single privilege or set of privileges can lead to a process gaining additional

privileges that were not explicitly granted. This is known as privilege escalation.

For example, a user with the privilege

PRIV_DACWRITE alone may overwrite critical operating system

ﬁles and, in the process, may grant himself additional privileges beyond

PRIV_DACWRITE